2019 Network Traffic Measurement and Analysis Conference (TMA)最新文献_第3页

Clairvoyant Networks 透视网络

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784643

Cheng Jin, C. Lumezanu, Zhi-Li Zhang, Haifeng Chen

{"title":"Clairvoyant Networks","authors":"Cheng Jin, C. Lumezanu, Zhi-Li Zhang, Haifeng Chen","doi":"10.23919/TMA.2019.8784643","DOIUrl":"https://doi.org/10.23919/TMA.2019.8784643","url":null,"abstract":"We use the term clairvoyant to refer to networks which provide on-demand visibility for any flow at any time. Traditionally, network visibility is achieved by instrumenting and passively monitoring all flows in a network. SDN networks, by design endowed with full visibility, offer another alternative to network-wide flow monitoring. Both approaches incur significant capital and operational costs to make networks clairvoyant.In this paper, we argue that we can make any existing network clairvoyant by installing one or more SDN-enabled switches and a specialized controller to support on-demand visibility. We analyze the benefits and costs of such clairvoyant networks and provide a basic design by integrating two existing mechanisms for updating paths through legacy switches with SDN, telekinesis and magnet MACs. Our evaluation on a lab testbed and through extensive simulations show that, even with a single SDN-enabled switch, operators can make any flow visible for monitoring within milliseconds, albeit at 38% average increase in path length. With as many as 2% strategically chosen legacy switches replaced with SDN switches, clairvoyant networks achieve on-demand flow visibility with negligible overhead.","PeriodicalId":241672,"journal":{"name":"2019 Network Traffic Measurement and Analysis Conference (TMA)","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133615028","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

[TMA 2019 Front cover] [TMA 2019封面]

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/tma.2019.8784529

引用次数: 0

A URL-based Analysis of WWW Structure and Dynamics 基于url的WWW结构与动态分析

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784665

Jeffery Kline, Edward Oakes, P. Barford

{"title":"A URL-based Analysis of WWW Structure and Dynamics","authors":"Jeffery Kline, Edward Oakes, P. Barford","doi":"10.23919/TMA.2019.8784665","DOIUrl":"https://doi.org/10.23919/TMA.2019.8784665","url":null,"abstract":"Understanding the evolving characteristics of the World Wide Web is challenging due to its immense size and diversity. In this paper, we investigate Web structure and dynamics by analyzing over 1 trillion URLs requested during Web browsing by a 2 million person user panel over a period of 12 months. We begin by examining the lifetime of URLs and find that in contrast to early studies, the set of URLs visited is highly dynamic and well-modeled by a gamma distribution. Next, we analyze URL-traversal patterns and find that browsing behaviors differ substantially from hyperlink connectivity. One consequence of this is that the structure of the Web that is derived from hyperlink connectivity does not extend directly to actual user behavior. Finally, we consider the commonly used path and query portions of URLs and highlight their characteristics when used by different website genres. These semantic differences suggest that URL structure can broadly classify the kind of resource that a URL references. Our analyses lead to a set of proposed enhancements to the URL standard that would improve Web manageability and transparency and make a step toward the semantic web.","PeriodicalId":241672,"journal":{"name":"2019 Network Traffic Measurement and Analysis Conference (TMA)","volume":"66 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130385010","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Energy Savings & Resiliency with Closed Loop Platform Automation 闭环平台自动化的节能和弹性

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784669

John J. Browne, Krzysztof Kepka, Patrick Kutch, Sunku Ranganath

引用次数: 0

Chocolatine: Outage Detection for Internet Background Radiation 巧克力:互联网背景辐射的中断检测

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784607

Andreas Guillot, Romain Fontugne, Philipp Winter, P. Mérindol, Alistair King, A. Dainotti, C. Pelsser

{"title":"Chocolatine: Outage Detection for Internet Background Radiation","authors":"Andreas Guillot, Romain Fontugne, Philipp Winter, P. Mérindol, Alistair King, A. Dainotti, C. Pelsser","doi":"10.23919/TMA.2019.8784607","DOIUrl":"https://doi.org/10.23919/TMA.2019.8784607","url":null,"abstract":"The Internet is a complex ecosystem composed of thousands of Autonomous Systems (ASs) operated by independent organizations; each AS having a very limited view outside its own network. These complexities and limitations impede network operators to finely pinpoint the causes of service degradation or disruption when the problem lies outside of their network. In this paper, we present Chocolatine, a solution to detect remote connectivity loss using Internet Background Radiation (IBR) through a simple and efficient method. IBR is unidirectional unsolicited Internet traffic, which is easily observed by monitoring unused address space. IBR features two remarkable properties: it is originated worldwide, across diverse ASs, and it is incessant. We show that the number of IP addresses observed from an AS or a geographical area follows a periodic pattern. Then, using Seasonal ARIMA to statistically model IBR data, we predict the number of IPs for the next time window. Significant deviations from these predictions indicate an outage. We evaluated Chocolatine using data from the UCSD Network Telescope, operated by CAIDA, with a set of documented outages. Our experiments show that the proposed methodology achieves a good trade-off between true-positive rate (90%) and falsepositive rate (2%) and largely outperforms CAIDA’s own IBR-based detection method. Furthermore, performing a comparison against other methods, i.e., with BGP monitoring and active probing, we observe that Chocolatine shares a large common set of outages with them in addition to many specific outages that would otherwise go undetected.","PeriodicalId":241672,"journal":{"name":"2019 Network Traffic Measurement and Analysis Conference (TMA)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133011314","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 21

A Bottom-Up Investigation of the Transport-Layer Ossification 传输层骨化的自下而上研究

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784690

Korian Edeline, B. Donnet

{"title":"A Bottom-Up Investigation of the Transport-Layer Ossification","authors":"Korian Edeline, B. Donnet","doi":"10.23919/TMA.2019.8784690","DOIUrl":"https://doi.org/10.23919/TMA.2019.8784690","url":null,"abstract":"Recent years have seen the rise of middleboxes, such as NATs, firewalls, or TCP accelerators. Those middleboxes play an important role in today’s Internet, and are now extensively deployed in various networks including corporate networks, Tier-1 ASes, cellular networks, and WiFi hot-spots.Unfortunately, despite the added value that they bring to networks, they radically change the transport paradigm from the legacy end-to-end principle, and drive increasing complexity in the path. The consequences of these changes are a wide variety of simple to subtle impairments to protocols and features, that in turn lead to the ossification of the network infrastructure. While the latter is now a well-known problem, its causes are not that much understood.To fill this gap, we provide a more detailed explanation of the factors of the transport-level ossification, and we give insights on their prevalence in the wild. We extract path conditions by processing a large collection of observations of middlebox in-path packet manipulations, and we categorize the observed transport impairments based on the complications that they engender. We show that more than one third of network paths are crossing at least one middlebox, and a substantial percentage are affected by feature or protocol-breaking policies. Finally, we show that the majority of the devices that implements them are located in edge networks.","PeriodicalId":241672,"journal":{"name":"2019 Network Traffic Measurement and Analysis Conference (TMA)","volume":"104 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133181895","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 8

Interactions between Congestion Control Algorithms 拥塞控制算法之间的相互作用

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784674

Belma Turkovic, F. Kuipers, S. Uhlig

引用次数: 20

Demonstrating the Cost of Collecting In-Network Measurements for High-Speed VNFs 演示高速VNFs的网内测量采集成本

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784546

Leonardo Linguaglossa, Fabien Geyer, Wenqin Shao, F. Brockners, G. Carle

{"title":"Demonstrating the Cost of Collecting In-Network Measurements for High-Speed VNFs","authors":"Leonardo Linguaglossa, Fabien Geyer, Wenqin Shao, F. Brockners, G. Carle","doi":"10.23919/TMA.2019.8784546","DOIUrl":"https://doi.org/10.23919/TMA.2019.8784546","url":null,"abstract":"Recent advances in the state-of-the-art of software packet processing along with the incarnation of SDN and NFV in networking brings the utility of software switches in production to a high level. Accompanied with the wide deployment of the latter, comes the practical and urgent need of monitoring networks that are composed of software forwarders/switches. On the one hand, this may provide new types of very finegrain operational data that can be collected, thus bringing the opportunity for network managers to get a deeper understanding of the underlying network state and performance. On the other hand, this massive data availability comes at a cost: software measurements can highly affect the measured values, thus biasing the collected data. The intensity of this bias becomes stronger when measurements are taken close to the data path. We believe that this trade-off should be explored more in detail, since the availability of fine-grained data offers new opportunities to apply machine learning techniques to infer changes in the network state, to forecast the evolution of some performance metrics or to automatically respond to event triggers without the human intervention. While our long-run objective1 is a full framework for performing automated test on software routing platforms, in this demonstration we focus on two key points that are prerequisite for our approach: (i) we showcase the impact of collecting the desired data within a Virtual Network Function and (ii) we setup a simple environment for data visualization on the same physical device.","PeriodicalId":241672,"journal":{"name":"2019 Network Traffic Measurement and Analysis Conference (TMA)","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129733287","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Rate Measurement Over Short Time Scales in Stationary Cellular Receivers 固定蜂窝接收机短时间尺度上的速率测量

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784668

H. Haile, Per Hurtig, Karl-Johan Grinnemo

引用次数: 2

BGP hijacking classification BGP劫持分类

2019 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2019-06-01 DOI: 10.23919/TMA.2019.8784511

Shinyoung Cho, Romain Fontugne, Kenjiro Cho, A. Dainotti, Phillipa Gill

{"title":"BGP hijacking classification","authors":"Shinyoung Cho, Romain Fontugne, Kenjiro Cho, A. Dainotti, Phillipa Gill","doi":"10.23919/TMA.2019.8784511","DOIUrl":"https://doi.org/10.23919/TMA.2019.8784511","url":null,"abstract":"Recent reports show that BGP hijacking has increased substantially. BGP hijacking allows malicious ASes to obtain IP prefixes for spamming as well as intercepting or blackholing traffic. While systems to prevent hijacks are hard to deploy and require the cooperation of many other organizations, techniques to detect hijacks have been a popular area of study. In this paper, we classify detected hijack events in order to document BGP detectors output and understand the nature of reported events. We introduce four categories of BGP hijack: typos, prepending mistakes, origin changes, and forged AS paths. We leverage AS hegemony – a measure of dependency in AS relationship – to identify forged AS paths in a fast and efficient way. Besides, we utilize heuristic approaches to find common operators’ mistakes such as typos and AS prepending mistakes. The proposed approach classifies our collected ground truth into four categories with 95.71% accuracy. We characterize publicly reported alarms (e.g. BGPMon) with our trained classifier and find 4%, 1%, and 2% of typos, prepend mistakes, and BGP hijacking with a forged AS path, respectively.","PeriodicalId":241672,"journal":{"name":"2019 Network Traffic Measurement and Analysis Conference (TMA)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117043250","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 45